3ab88882429adf3b605e9f6e85f4417cfc69f6302774a2b854efc31cc98b6034

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_72f4cde22433c2d3bc53a71d9a808d56_elex_wannacry.exe
Size 15.4MB
Sample260816-exvxqabb75
SHA256 3ab88882429adf3b605e9f6e85f4417cfc69f6302774a2b854efc31cc98b6034
MD5 72f4cde22433c2d3bc53a71d9a808d56
SHA1 4f88f1f72d95b5b94c64a216f4074980818f237d
SHA512 6459e22bd15192aa6e97b0ecb34aed6d22871ccb55e162bd6c61ece5887e8ee0fdb78ad01f8389a3295a06d09c3e84ec46395909f43fb4910fee043544da2b08
SSDEEP 49152:U+ES+ES+Ep+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Es:OW1PszZ
TLSH
T14AF63A09FD4344B1D92B51B04DCFE3BF8A60BB2582128DF7FB4ECB5B6523BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4756	svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe
4908	svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe
3652	svchost_CCBCCCBBBAACACBCCACBACBABBABBACABBBAAABCBACCCBBABCACACB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBAACCACBCCBACBCBACBBCABCACABACBACBCBBBCBCBCCCABBCAAAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe"	2026-08-16_72f4cde22433c2d3bc53a71d9a808d56_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCAACBBBCABCBCCCCCAACCBCBCCCACCABBACBCCCAACCACBAABCBACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCCCBBBAACACBCCACBACBABBABBACABBBAAABCBACCCBBABCACACB.exe"	svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5320	sc.exe
3120	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2464	cmd.exe
4264	cmd.exe
3148	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCCCBBBAACACBCCACBACBABBABBACABBBAAABCBACCCBBABCACACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_72f4cde22433c2d3bc53a71d9a808d56_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5476	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3300	2026-08-16_72f4cde22433c2d3bc53a71d9a808d56_elex_wannacry.exe
3300	2026-08-16_72f4cde22433c2d3bc53a71d9a808d56_elex_wannacry.exe
3300	2026-08-16_72f4cde22433c2d3bc53a71d9a808d56_elex_wannacry.exe
3300	2026-08-16_72f4cde22433c2d3bc53a71d9a808d56_elex_wannacry.exe
4756	svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe
4756	svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe
4756	svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe
4756	svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe
3652	svchost_CCBCCCBBBAACACBCCACBACBABBABBACABBBAAABCBACCCBBABCACACB.exe
3652	svchost_CCBCCCBBBAACACBCCACBACBABBABBACABBBAAABCBACCCBBABCACACB.exe
4908	svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe
4908	svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3300	2026-08-16_72f4cde22433c2d3bc53a71d9a808d56_elex_wannacry.exe
Token: SeDebugPrivilege	4756	svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe
Token: SeDebugPrivilege	3652	svchost_CCBCCCBBBAACACBCCACBACBABBABBACABBBAAABCBACCCBBABCACACB.exe
Token: SeDebugPrivilege	4908	svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 2464	3300	2026-08-16_72f4cde22433c2d3bc53a71d9a808d56_elex_wannacry.exe	91
PID 2464 wrote to memory of 5476	2464	cmd.exe	93
PID 4756 wrote to memory of 4600	4756	svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe	94
PID 3300 wrote to memory of 4264	3300	2026-08-16_72f4cde22433c2d3bc53a71d9a808d56_elex_wannacry.exe	95
PID 4264 wrote to memory of 5320	4264	cmd.exe	97
PID 3300 wrote to memory of 3148	3300	2026-08-16_72f4cde22433c2d3bc53a71d9a808d56_elex_wannacry.exe	98
PID 3148 wrote to memory of 3120	3148	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-16_72f4cde22433c2d3bc53a71d9a808d56_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_72f4cde22433c2d3bc53a71d9a808d56_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACBBCBAABBAAACCABABAABBCCAABBCCCBCABABCABBBBABCBBBCBCBACABCACCACCCBCACBABCABCABAACACAAAABAAAACACBBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACBBCBAABBAAACCABABAABBCCAABBCCCBCABABCABBBBABCBBBCBCBACABCACCACCCBCACBABCABCABAACACAAAABAAAACACBBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBCCBCAAAABACACCACBCACABBBABBBBBCAAACABABBACCBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe" start= auto displayName= "UserDataSvc_CCBBCCBCAAAABACACCACBCACABBBABBBBBCAAACABABBACCBCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBCCBCAAAABACACCACBCACABBBABBBBBCAAACABABBACCBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe" start= auto displayName= "UserDataSvc_CCBBCCBCAAAABACACCACBCACABBBABBBBBCAAACABABBACCBCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBCCBCAAAABACACCACBCACABBBABBBBBCAAACABABBACCBCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBCCBCAAAABACACCACBCACABBBABBBBBCAAACABABBACCBCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3120

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4600

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCBBBAACACBCCACBACBABBABBACABBBAAABCBACCCBBABCACACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCCBBBAACACBCCACBACBABBABBACABBBAAABCBACCCBBABCACACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 42fdc9c08dc89f4ba4f9d7f2d9b0fe96740d2634c525a7313e17f4614b19dee6
MD5 afd966cb44a94295115ed207eab835bf
SHA1 0350edd278d86e3265ecaf5854ada7cff40e1606
SHA512 e9af5c895f31f80965722ed9c3208d509d4527b39537907da9bfc9029f4bb7521747a14de012af0631120b4dc453ca0aa43653a0c8f3714aa2ea8c54ef56283b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows Defender\Scans\qap`g`v~dtlq
Size 10B
SHA256 69936f8f95a4c9d85c656a31a16d194f55f5cdee94eacd7410195ddd7101bcf4
MD5 65afb7aff325be47da5627ce9822407a
SHA1 7b03a5e60d13c9781268685866f375db93ff264a
SHA512 ccb25bb67ee35b8cb07beac54cb88c53ecce921e8c4767b3a1ad545e16590511f09aaee6d9a0978a907ad66173d17aa78868434a9df6c1a2ac3e11a50a59feb4
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 12.2MB
SHA256 3eb38be22985bbd260888289c3122eade72b92e6280bae6edad9f229a137a8b2
MD5 94b67b7c53705e51dc7f19396b09f913
SHA1 3e9cb4e8b9ce5b738306746d338d6dec3b889f15
SHA512 fa86428c9df4266e739b902c8a01c85093929310e42fe9471d434002454c3aefd423eb3abe178a4975537ac5cf5bbd03cd1b9a2bc0d21dc3e85ec06faf649011
SSDEEP 49152:U+ES+ES+Ep+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+EU:Q
TLSH
T198D62A09FD4344B1D92B51B04DCFE3BF8A60BB2582128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MEIPreload\qap`g`v~dtlq
Size 10B
SHA256 a30590527d3746fc0ba50cefe1032080015dd95bfe6188633f2643d9d0893da4
MD5 e43b6b2eaa1f42b778a3ea2e4ab001b7
SHA1 9614bfdb62cef9ee618ccd5ad534537bc922cfcb
SHA512 aa15dbf9a261174b2db09d3057429687b1edfb816d346d8e9e32566d4063badaa7d6d9cb7c9629d1371bc8cf519e4b526480ba09794b17c76aaea9f2dd62906e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ef1f3284c6ed3a214af0b07feb5481749d5e4eeea14abd49498c8c82f75fcf9e
MD5 ae0b6179045f885f824ec0b30bbe29b2
SHA1 0345feb2d875e5318089a9a2930322acd24959d9
SHA512 b87ed5d03c75acaebd2ce05bbedce74772c45510a583b66466b5ddd83774bcd86795c3fba09c22303365833cfedb10a38cfc86547f0e4221690594863b80b90a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3a7ed638f4f5565337c271f9eb9aa795e391915d3415d26cb762edb1e72998b7
MD5 d69ce38cc9c7644ad2d994f51e6098cd
SHA1 e4ba039725758c897f875845e89b3d2a115efdb9
SHA512 61d18724e9fe19bd8b9a4ae20eb3c3a28348b7a15165633e578ca859f3ceaeab84f986eff02033614bf5b96a54096afa4bf0ca68adce722c1d2c2403a405868f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8a4c15cc838d3bf0e24743a733cea77dafab2095c410f55bd23d44f647168a7a
MD5 80dc491fd3bce19f040f4a1c87ce502b
SHA1 484fea202678e51b294ce10818530b621e61957e
SHA512 100a76f7107c9c1f50e8703aba3bbb7716d501a926a44abf0a6073cb1076f464e01c9e0ba0df8407e4787fc321412dafba2e80af08cbc2d3a13077508ecd94f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0e42daf1611b582260ba7a65fe8577600b6028dab4cf9afeeae17d39ee001e5b
MD5 5fc1b0980cdd3eb92a49daee860be586
SHA1 96fe0ff8bbd63f5438fc7be7283522ea032a9763
SHA512 965fbc0e5da498a875f0479a1e696e7b59137871271d3ea1f9a77440242eab21430ee35a2e5bd2f509496d2e9a87bfc3f94717ef23dbd555ddee44fb32165ff1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dacaba594415173628ad36b850d8164b59dfa24632e880152f2bd98a96e1a1c3
MD5 7773ddf5cdba5cbb99b26ed83165b2c9
SHA1 a16f0601963f95cce843b13bb5a6ba0396a4618c
SHA512 949c1e9c4506e69d74152e3b577795648704f557f46bad758aa296314a10de9638f9318ff81a2df13ee41e9b39415786aefa5c8c2e3f9e25360138e475945a62
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 07295fec19c62ee8828287b830e8d8d25c23bb4d3e49462c8ca3eb00a905c5a8
MD5 6d01f3d06f04811ef2608b7c5aae6313
SHA1 06d1c7e9a217ce21cb070220d7a48f4ae74c1c11
SHA512 4359ed62c07e6e57dfc6b42e393e3fd76ea0794818659cc498d0ad3e3ae00e4c9be83817aa6c323e2e0633da3bdce34933827ee3917dbb9935543fb9b87e8695
MD5 SHA1 SHA512

Submit Download

svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBCBABACBBBACCAACCBCCCCACCBCBABBCBBACBACBAAACCBBCCCC.exe
Size 15.4MB
SHA256 3ab88882429adf3b605e9f6e85f4417cfc69f6302774a2b854efc31cc98b6034
MD5 72f4cde22433c2d3bc53a71d9a808d56
SHA1 4f88f1f72d95b5b94c64a216f4074980818f237d
SHA512 6459e22bd15192aa6e97b0ecb34aed6d22871ccb55e162bd6c61ece5887e8ee0fdb78ad01f8389a3295a06d09c3e84ec46395909f43fb4910fee043544da2b08
SSDEEP 49152:U+ES+ES+Ep+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Es:OW1PszZ
TLSH
T14AF63A09FD4344B1D92B51B04DCFE3BF8A60BB2582128DF7FB4ECB5B6523BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 cc827cabaab82d863a5599b5689ac2fd97bb66d466015bc9b2ad9dfc2bb20024
MD5 5e3f22c038d8c2a679bcdc4edd0b3b0a
SHA1 2303577536099a31f1b2ea23476b93e672f65f89
SHA512 8f05f39d733ec02742aa4892c1ae9599f69921f1f0232ff9933761f33322ad71c829c77db4f4e1face0d5d72856fc15dbee0f6ed4bf32b85da8ddc8adab44f5a
TLSH
T19C11E745DCE5E853EA3228CFA72DCF8308AA378B589C6A94230D5118F7A9D319D590E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 9658cf1ba31ddff0f358486d9c12339cf31a063bce8331475847879c95092c53
MD5 34a0ddcc9c152839cc0ca359d1f8d1c6
SHA1 ab5644b7746879f98b6662665abbf283255d128a
SHA512 edc764ec81a132ac8ac7e13bc24c4d187f83284589afde778ee8cfae900a9c0515db19d7ac2880f19ad3aec71284f02d623925003fc8a44fd177e0d969e465e0
TLSH
T10A210845DCE5E853EE3228CFA72DCFC308AA378B585C6A94230D5118F7A9D324E590E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3300-6-0x0000000000290000-0x00000000002B1000-memory.dmp

Download

memory/3652-81-0x00000000004E0000-0x0000000000501000-memory.dmp

Download

memory/4756-35-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/4756-22-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/4908-336-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/4908-66-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download